A federal agency we spoke with last year ran a post-incident review after an insider threat event. The physical access logs showed the employee badged into a restricted server room at 11:47 PM. The network logs showed an authenticated session on a privileged account starting at 11:52 PM. Nobody had connected those two events in real time — not because the data wasn't there, but because the PACS vendor and the IAM vendor had never been required to talk to each other. The breach had a five-minute window that two separate contracts had quietly agreed to ignore.
That is the actual problem. Not technology. Contracts.
The Split-Vendor Model Has a Structural Flaw, and Agencies Keep Paying for It
Federal physical security deployments have historically followed a familiar pattern: one contractor handles cameras, access control, and intrusion detection. A separate vendor — often an IT shop with no field experience — handles identity, authentication, and session management. The assumption is that these are different disciplines requiring different expertise.
That assumption made sense in 2005. It does not make sense under Zero Trust Architecture, which Executive Order 14028 mandated agencies begin implementing in 2021, and which OMB Memo M-22-09 put on a hard deadline. Zero Trust requires continuous verification — not just at the perimeter, but at every access event, physical or logical. You cannot build a continuous verification model with two vendors who invoice separately and escalate to different program offices.
Here is what split-vendor deployments actually produce in the field:
- Physical access control systems (PACS) that log badge events into one database with no API connection to the identity provider managing network sessions
- Cameras that authenticate to the VMS with local credentials that neither vendor owns or monitors
- FICAM-compliant PIV readers on the door with zero logical binding to the workstation on the other side of that door
- Two punch lists, two warranty periods, two help desk numbers — and a gap in the middle where your actual risk lives
- A contracting officer who has to manage two separate PWSs when something breaks at 2:00 AM on a Saturday
The General Services Administration's FICAM Roadmap is explicit: logical and physical access control should be unified under a single identity framework. Agencies have been reading that guidance for over a decade and still awarding split contracts. The gap between policy and procurement is where incidents happen.
The Handoff Is Where Things Break
Every multi-vendor deployment has an integration boundary — the point where one team's responsibility ends and another's begins. On paper, that boundary is documented in a CONOPS or an interface control document. In the field, that boundary is where finger-pointing starts.
Consider a typical scenario: a VA medical center deploys a new PACS across eight buildings. The physical integrator completes their scope — readers, controllers, door hardware, VMS, intrusion panels. They deliver a punch list, get a COR signature, and move to the next project. Six weeks later, the IAM vendor shows up to deploy PIV-based authentication for workstations and remote access. They need the PACS to pass physical presence data to the identity provider. The PACS integrator is gone. The API documentation is incomplete. The controller firmware is three versions behind the one the IAM vendor tested against. Nobody in the room has the authority to change either contract's scope.
That scenario is not hypothetical. It plays out on federal campuses every year. The cost to resolve it — scope changes, travel, re-engineering — routinely runs 15 to 30 percent of the original integration budget. On a $500,000 PACS deployment, that is $75,000 to $150,000 in unplanned spend that could have been avoided with a single contract structure.
The handoff is not a technical problem. It is an accountability problem. Two vendors means two project plans, two definitions of "done," and one gap in the middle that neither contract covers.
NIST SP 800-116 Rev. 1, which governs PIV card use in physical access control, explicitly describes the need for a unified identity assertion across both physical and logical access domains. When two vendors are each reading half of that document, you get half a solution.
One Contract, One Team, One Outcome
When the same integrator designs the physical security system and deploys the persistent authentication layer, the integration boundary disappears. That is not a marketing claim — it is an engineering reality.
The team that mounts the camera is the team that configures the session policy. The technician who wires the PACS controller understands the identity binding that controller needs to support. The engineer who writes the VMS access policy is the same engineer who provisions the service accounts that policy governs. There is no handoff document because there is no handoff.
What this produces in practice:
- Single accountability: One phone call when the system has an issue. No vendor boundary to argue over, no escalation matrix that loops back to you with no answer.
- Coherent system design: Physical and logical security are designed together from the requirements phase, not stitched together after two separate deployments.
- Lower total cost of ownership: One mobilization, one project manager, one set of contingencies, one warranty structure. Duplicated overhead is eliminated before the contract is awarded.
- Real-time event correlation: Physical access events and network sessions are designed to talk to each other from day one, not integrated as an afterthought.
- Cleaner audit trail: When an OIG auditor or a FISMA reviewer asks for a unified log of physical and logical access events, you have one. Not two exports from two systems that someone has to correlate manually in Excel.
From a procurement standpoint, this also simplifies the contract structure. One PWS, one set of deliverables, one CLIN structure covering both physical installation and authentication configuration. The COR has a single point of contact for technical direction. The COTR is not managing interface agreements between two primes. That administrative simplification has real dollar value — federal program offices spend significant resources managing vendor interfaces that a unified contract eliminates.
What Real Integration Actually Looks Like
The end state of a unified physical-plus-authentication deployment is a security posture where physical access events drive network policy in real time. This is not theoretical. The technical capability exists today using PACS-to-ICAM integration patterns that GSA and DHS CISA have both documented.
Here is what that looks like in a working deployment:
- A user badges into a Sensitive Compartmented Information Facility (SCIF) at 0800. The PACS event triggers a conditional access policy that elevates that user's network session to a higher trust tier for the duration of their physical presence.
- That same user's PIV-authenticated workstation session is continuously validated against their physical location. If their session attempts to access a resource associated with a different building, the system challenges the request.
- At end of day, when the user badges out, the elevated session tier drops automatically. No manual de-provisioning. No standing privileges waiting to be exploited during off-hours.
- A security operations center operator sees both physical and logical events in a single pane of glass. The 11:47 PM badge swipe and the 11:52 PM privileged session are correlated automatically, not discovered six weeks later in a post-incident review.
That level of integration does not come from two vendors coordinating over email and a shared SharePoint folder. It comes from one team that owns the full stack — from the door hardware to the identity provider — and is accountable for how those layers communicate.
A badge swipe at a server room door should be able to trigger a network policy change. A session drifting from its authenticated device should challenge the physical access that depends on it. That is Zero Trust. It requires one team, not two.
Under DoD's Zero Trust Strategy published in 2022, pillar four specifically addresses user activity monitoring that spans both physical and logical domains. Agencies pursuing ZT maturity levels 2 and above need this kind of event correlation. They will not achieve it with a PACS vendor who has never seen an identity provider and an IAM vendor who has never set foot in a server room.
The Bottom Line
If your next physical security upgrade and your authentication deployment are going to separate vendors, ask your contracting officer one question before awards go out: who is contractually responsible for the integration between those two systems? If the answer is a memorandum of understanding between two primes, or a coordination clause that nobody has enforcement authority over, you already know how that project ends.
Award the physical security integration and the authentication layer to the same vendor. Require a unified design document that shows physical access events binding to logical session policy before a single reader is mounted. Build the correlation requirement into the PWS acceptance criteria, not the lessons learned report.
TSS Group deploys both layers under one contract, one project manager, and one warranty. If you are planning a PACS upgrade, a FICAM alignment, or a Zero Trust pilot and want to see what a unified scope looks like before you finalize your requirements, contact us. We will show you the design before you commit to anything.